wp-mcp

Turn WordPress into an AI-operable surface with the wp-mcp server. It exposes WordPress CRUD primitives to MCP clients so you can draft, revise, and publish content, inspect users, manage terms and settings, and keep everything in sync through a secure, capability-based workflow. This enables editors and AI assistants to work directly with posts, comments, users, and site metadata without switching to wp-admin.

How to use

You connect an MCP client to the wp-mcp server to perform WordPress actions from your editor or AI assistant. The server centralizes primitives for posts, comments, users, terms, metadata, options, and site settings, and it enforces WordPress capabilities so users only access what they are allowed to perform.

Local STDIO workflow lets you access the WordPress database directly from your machine. Remote HTTP workflows expose the same primitives over the Internet via an Express server and a streaming transport. You can add a local proxy when your MCP client lacks OAuth or WordPress Application Password support, making it easy to integrate MCP actions into your existing editorial pipelines.

To verify what primitives you can use for a given WordPress user, list the available primitives and their required capabilities.

How to install

Prerequisites you need installed on your workstation:

Step by step setup for a local STDIO server (direct database access) and a remote HTTP server (remote access). Use the commands exactly as shown.

# 1) Set up a local STDIO MCP server connected to your WordPress database
npx @rnaga/wp-mcp -- local config-set

# When prompted, provide:
# host, port, database name, user, password
# If SSL is required, provide CA/cert/key paths

# Review saved values later
npx @rnaga/wp-mcp local config

# 2) Start the local STDIO MCP server for your MCP client (e.g., Claude Desktop)
# This uses the complete command from the README example
npx -y @rnaga/wp-mcp -- local start

# 3) (Optional) Inspect available primitives and required capabilities
npx @rnaga/wp-mcp -- utils list-prims

# 4) If you prefer an HTTP server for remote access, scaffold the HTTP server project
npx @rnaga/wp-mcp -- http init

# 5) Run the HTTP server in development or production as you would for a typical Node project
# Development
npm run dev
# Production
npm run build
npm run start

Security and access control

Access control is enforced by the HTTP layer for remote transports and by WordPress capabilities for local sessions. The server can authenticate via OAuth bearer tokens or WordPress Application Passwords. Privileged actions are gated by the user’s WordPress roles; administrators have full access, while lower-privilege roles see only permitted primitives.

For HTTP deployments, bearer tokens are validated against the OAuth provider, and Application Passwords are accepted via HTTP Basic authentication. If a request is not authorized, the server responds with a standard error that guides you to recover access.

Example usage patterns

Draft and publish a post from an MCP client, guided by the available primitives for your WordPress user. Review which actions you can perform, then call the corresponding tools, resources, or prompts to manage posts, comments, users, and site metadata.

Inspect site metadata or user roles by listing the available primitives and performing read operations on posts, terms, and options as permitted by your WordPress credentials.

Notes and troubleshooting

If you need to adjust credentials or environment details, you can re-run the local configuration wizard or inspect stored settings with the CLI utilities. The inspector tool provides a visual interface to explore available primitives and test them against your WordPress instance.

Available tools

list-prims

Display the available MCP primitives with their required capabilities and roles.

inspector

Interactive testing tool to explore primitives, test calls, and inspect server responses.